Windows Analysis Report
WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf

Overview

General Information

Sample name:	WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf
Analysis ID:	1523393
MD5:	ea9de4ef0bb89d78522c10d5a32b8d7d
SHA1:	0435be41c86391f6e6bc7dae22fea79e0eab8fec
SHA256:	bffcdccde64e4594e6f81e73e7abea098f6c54fcfdc77f66f2d53dc5769a3c6f
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 192.168.2.8:49719 -> 23.200.196.138:443
Source: global traffic	TCP traffic: 23.200.196.138:443 -> 192.168.2.8:49719

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT

Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	TCP traffic detected without corresponding DNS query: 23.200.196.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719

Source: classification engine

Classification label: clean2.winPDF@14/43@1/1

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 09-08-46-913.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,859850338029047367,11111397360101548855,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1632,i,859850338029047367,11111397360101548855,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf	Initial sample: PDF keyword /JS count = 0
Source: WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A911tu2ak_kdibqe_1o0.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A911tu2ak_kdibqe_1o0.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf

Initial sample: PDF keyword obj count = 109

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
windowsupdatebg.s.llnwi.net	46.228.146.128	true
x1.i.lencr.org	unknown	unknown

ID:	1523393
Product:	CloudBasic
Start time:	15:07:46
Start date:	01.10.2024
Sample:	WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ea9de4ef0bb89d78522c10d5a32b8d7d
SHA1:	0435be41c86391f6e6bc7dae22fea79e0eab8fec
SHA256:	bffcdccde64e4594e6f81e73e7abea098f6c54fcfdc77f66f2d53dc5769a3c6f
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	40F4E8CF3F4766F4FC4DAB6994974EC0	C88F7BC03B48C744D5B4F94D417EF2C6CB5114C6	0B5A064105822774F25B8B6709B0F101B5847AB32B69BE001D20194F68329CF9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	40F4E8CF3F4766F4FC4DAB6994974EC0	C88F7BC03B48C744D5B4F94D417EF2C6CB5114C6	0B5A064105822774F25B8B6709B0F101B5847AB32B69BE001D20194F68329CF9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	616CDF2B761FCFCE6A31F9AC3CA323A9	C87E4964FFBF5D430A1918AA4F3B958EA52CBAE7	E7487C170AB61D35FD6B7C5608B723106671FFB1C1E55EE4A48AAB0DCB2FA563
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	616CDF2B761FCFCE6A31F9AC3CA323A9	C87E4964FFBF5D430A1918AA4F3B958EA52CBAE7	E7487C170AB61D35FD6B7C5608B723106671FFB1C1E55EE4A48AAB0DCB2FA563
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2547a05f-46b5-41dd-b3bc-fb22fb4b0ac3.tmp	JSON data	F7F1CD2D53965E977D6635B7C49A6132	1BAC64A74FC426290CCBEF72595AB84254F59F0A	A27575AFB3A9868E652DA4C88FED84208264F2B577263ABF2359C6EF761B77B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F7F1CD2D53965E977D6635B7C49A6132	1BAC64A74FC426290CCBEF72595AB84254F59F0A	A27575AFB3A9868E652DA4C88FED84208264F2B577263ABF2359C6EF761B77B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	1C9A58782544520008595827F4776480	D600AED10F70D28D10878CB0F25A29B82B282A3F	98A2870634BE7D0986D5E4A8AEFB1783E63FE5CE155B2912F5C2CDE1ACE0DCED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	DECC891316D1915D3D7FDD0383BE3245	0BBA3A53CEB4C2B01E4734145CDC2E3467E51CAA	ADB63F36AA5676EA2398C0DB0F51793E4C5796B265BC70ED299136BAE2073013
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	DECC891316D1915D3D7FDD0383BE3245	0BBA3A53CEB4C2B01E4734145CDC2E3467E51CAA	ADB63F36AA5676EA2398C0DB0F51793E4C5796B265BC70ED299136BAE2073013
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241001130849Z-176.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	C6BBC68AFC95E50299121FE22C07B045	6E17EAE55F974557599F12F8B8834E90DA884DCB	87092504E4098DE761A277BCC0F74B8EBDF0465689A47641726844512A90ED79
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	C1CCA858942D396C54951C6B0C36559A	98310256B0ED450A767C18D5343FB18C11737262	EC80D0CF92B2351CAA59027DF79577A6955B5D5DC8DDCF48DFF9743720436505
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	7DBE8A081B9367FC324AFCFAB09E8B0B	FB8A8974A3ACCD4666A2E9E0F9AC1BD6D2A48639	72708252A0513EC1C9D716D2A92509B030F4A31F57B5B9258341F32B69DC3D15
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	27094DF6D14B4D6728D59FFC4E31294B	CC768A8693F9C122496C2BE949E13F0C36AE7888	B26846BECCDB3792F05A996D2863C7A1D286BD9F997DBC2112604EBDD206FEAC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	7AFCF21225774F77D9D61DB926A429D1	31B2C2D65A36A2DBD619289FD34232794E750236	646C3AB4B97E2CFF65A684B05E43E145FB2F71D1AC49EF722A42F02D531F3524
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	20A1F7D381A65D034CDA25534F79165B	26E97F650E64C045EF0C5AA4E865E89262EC2969	536F1A24D292D83562A8DD74BAFBEAAE2486BD5FD140795CE0C2400D63CD8005
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4B39E95BD1786A66082FDB803CB609BC	B1BA11E4EAC49041DE9B2A4B0EBEB9B59590B488	463E5D793CBE495FF168B7AAE25437BA02426346C3515F323B5C8F8113D99AC6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	429FE445BB5802060270F32F016D459E	317A7C62279EF68C3FDD3B8BC0E08954944E845D	95C1C05069FACA178345454E9AE40ED0DAF1661FB8378F6F3F108E18C9EB91E2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B80A944187BC4500380A98F84A4E6B45	799AD6B59BA16C778EFD6BAAE5D3B02D69CD30B0	2576B4DC87B396C9DF2E82F3086F58B94E3E7CCC64FB85DD73FBA465EC3189C0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	B5B2E575D2107463352BB88CCB8C2E50	2F716C99FD5C33B64692AEAD728EB27BA5EBDCB4	D31AA39232C60F12E81F2AE3D49C7E824D2F704E5D7D2388E19F7FCDE7CEDA9D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	27ECCBEF7F2075C6A3C0D1BF6CEC5D74	BE630E5092669CBD067A0BEFC6307188435DB983	C60E2AF49F00BE1E3C16D5983D6B11ACF524A53FA712EA88A72DCB6267BE0ACB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	47CFBA40592F5B2F3E3E0161A971A34B	74EFB3B24542EAE3E15B09E504837C0FE2B9E4CB	23A91782F559A05BD4D4C79D94C736B49F60F642EF1E4C3CC52EDD4DDC8F26CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	5D11214222013025558E7BE2BB3335C5	1333153E429B0C2550D9AC0FC3D9D6AF6A26FE81	6AA6385FB7B10D3E0FF6876AFCFF97814E5FE5613C0679692B1AEF8F3C003E03
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	00132FC6BF35083A2952B4FD56F47BBB	9D6D7BDC9B3FADCF371F8EFD470F01CBB61E29DA	D06FEE865C222B21B3AC82DB889A8FA80D2CA1A867F2F72E48C838427BC391BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	C5B4039DEAAB14F328C4AFF57A77BA1A	F2877E39C672260CA65A76030B2BE9A22E41D5EA	84F83D5328A99FEC336CB6852BB08FA95025690F8D3D0CAA2EB9C538DED86783
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	902974A7B612F12A380D938FCF3D2F7B	A62F583BB0A61702AB5502FDBDAF4FB1DC4544EF	99C323D0FDAB53105E645D2958C82316D853A998A90BD2817D4366FB6EA6F6A6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	450B651B3099E4EF8307EA5AC5021565	D9AE577C3D04C49FC0C033D6FD0FD7E2CBDF39D6	278B6F0FFFF016F715969B067DCD7C15D37C89C8745EEB7C21A8DFAFE60570B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	02BC1DC6C404993EF3A7C356C026B4FC	2E70D24482A6A6A3173F7C5F911EAA433940F983	CEBA50AB814A752C96FCD1B45CEFEA85FADA1E20597012D33581EE4BC3BEAE6F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	B8D09EC24E1E434642EC7BFDB2878EEB	6087AEEF0F4FBFFCCECBDB00B44BF72E7D3329EF	FC641B34B06862A02D3354ADDA2F604311FC314F43095E5A7336C1FA8454991F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	79036A8935573A3075E91E1D7ABBD938	365CFDC46669D368E3704AD4BECBEC9866BD02D4	50A77B3708249CB9B186409C96F788D851FED9431F063EF2E6130011405453AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	6F111CEC361FB54AD4D6EC46867319D3	4964DDF91E663788FF560D9958B23421ABA2342F	F98566CCF39DE35469046B01F657588C21132D04644A278845640BC3F36276D2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	194632692F44552EA16CE39C52D4A197	D2EC600ADC11B5625856ADDB766E71919F8F625C	D9E6E14FFE1D142C49F7941732227E27007D012F5D764B401C296597B5839F0D
C:\Users\user\AppData\Local\Temp\MSI8a5bb.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A9C8ADD8C876AE1D29A98DDE822F91D4	B862896CA4680A70A020D1A7B23CC65930B4297A	14050807B65A37DA855371CB604402E1A494F8807649B9A6F3E70B6A2607C246
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A911tu2ak_kdibqe_1o0.tmp	PDF document, version 1.6, 0 pages	DADCC726266E4F0C26359256233A70D4	4D5199F3E0C5D6BC36A51DB690692BA6F9E2EBAE	8830A6702FDDE883DE9EFAF73B61E5FC9BB786B0D9B4FE8E48EFC1D2D8324910
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-01 09-08-46-913.log	ASCII text, with very long lines (393)	C3FEDB046D1699616E22C50131AAF109	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	A61FE10DACD9769BAEDA546AB7837981	0A8D634800E0E02973110CDC645F8F77E627479F	C6BB5E8762DB184C2E1CB4BF29FF51D2C1DEA6766D72A3BE3F0C3B8AB9B2327C
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E6C57CFFAC1054BF16063CBF7658154F	EB56F5D120DC56D16E6A17E407F5680C8F74800A	E3505176A80219C36B136B7C7BF7636225928A855D89A50CEC4617A774D80540
C:\Users\user\AppData\Local\Temp\acrocef_low\0a7dcdec-2fd7-482d-a2fc-b2abcbdfc459.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\0c825e2d-4bf5-477b-af74-12ea5c458d0e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\7c8a1476-541e-4b81-a102-7b3ce79d1e99.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\a7ef5dc8-4133-454b-ab63-f9394e5d4d7a.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	CA6B0D9F8DDC295DACE8157B69CA7CF6	6299B4A49AB28786E7BF75E1481D8011E6022AF4	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7

Windows Analysis Report
WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
WI Inspection Report - 763634 - UNITED ONE CREDIT UNION - 1117 S 10th St.pdf